OpenAI Claims AI Helped Fix Two-Year-Old PHP Bug Affecting Most of the Web

Seventy percent of the internet runs on a single piece of open-source software that just had a close call with disaster. OpenAI announced on October 21 that its artificial intelligence model, GPT-5.6 Sol, helped uncover critical security holes in PHP. This programming language is the engine behind an estimated seventy percent of all websites. The discovery has triggered a coordinated rush to patch systems across the globe to prevent potential attacks.

The core issue involves two specific flaws in how PHP handles computer memory. These bugs, tracked as CVE-2026-109618 and CVE-2026-109619, allow attackers to potentially take control of servers without needing login credentials. The first flaw occurs when the system runs out of allocated memory during a request, leaving behind incomplete data that the engine might later mistake for valid instructions. The second involves a fatal error that leaves the system pointing to memory that has already been freed, creating a space where subsequent requests can corrupt data or execute malicious code.

What makes this situation particularly concerning is that these vulnerabilities reside in the core PHP engine. This means a website could be compromised even if its own application code is perfectly secure. Researchers demonstrated that the flaws could expose sensitive information stored in server memory, such as passwords, authentication tokens, and API keys. Both issues received a critical severity score of 9.2 out of 10, marking them as high-priority threats for security teams.

The timeline of the discovery is striking. The PHP Foundation had actually known about the underlying flaw since 2024, but human developers were unable to find a way to exploit it or a way to fix it. It sat unresolved for two years. On July 30, 2026, researchers from Calif, a California-based cybersecurity firm and founding partner in OpenAI’s Patch the Planet initiative, began auditing PHP with AI tools at the Foundation’s request. By August 11, they identified the exploitable vulnerability, with OpenAI researchers confirming it the same day.

Once the flaws were identified, the process of fixing them took two months. OpenAI attributed this lengthy timeline to the complexity of the task, which required major changes to the PHP engine. A coalition of researchers, PHP maintainers, security providers, and government cybersecurity agencies worked together on the solution. The PHP Foundation has since released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. It is important to note that PHP 8.1 and older versions will not receive official fixes, meaning sites running those versions must upgrade to newer releases to stay secure.

The official release of these patches was originally scheduled for October 22, but it was moved up to October 21. This shift came after premature disclosures on October 20 led to public outcry and likely increased the urgency for developers to apply updates. OpenAI stated that every site using PHP can now safely upgrade its version to remain protected against these specific attacks. The company views this incident as one of the biggest cybersecurity discoveries of 2026 due to the sheer ubiquity of the language.

OpenAI is using this event to illustrate a concept it calls the Defender’s Window. The company argues that there is a narrow, critical timeframe during which organizations can use advanced AI models to find and patch vulnerabilities before those same AI-driven attack capabilities become widely available to bad actors. OpenAI introduced this idea after its models previously hacked Hugging Face. The company maintains that powerful technology will inevitably be used by malicious actors, making it a collective responsibility to act proactively.

There are, however, caveats and open questions surrounding this narrative. While AI researchers demonstrated practical exploits within two weeks, one could argue that the flaws would never have been exploitable without AI, making them effectively harmless in the real world. Human teams examined the code for two years without finding a fix or an exploit. This suggests that the value of AI in this context is not just in finding bugs, but in bridging the gap between a known theoretical flaw and a working attack vector. The incident highlights a shifting landscape where speed and AI assistance are becoming standard in cybersecurity defense.